DEBIAN-CVE-2019-12529
Record from OSV · Published July 11, 2019
An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| squid | Debian:14 | 4.8-1 |
| squid | Debian:12 | 4.8-1 |
| squid | Debian:13 | 4.8-1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | squid | 0 |
| Debian:12 | squid | 0 |
| Debian:13 | squid | 0 |
Timeline
- Jul 11, 2019 CVE Published
- Sep 21, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2019-12529
vulnetix vdb fixes DEBIAN-CVE-2019-12529Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2019-12529/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart